https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522154#M147223 <P>Should this "day column" go on a row of its own? What if you have more than one data rows for a particular day?</P><P>Maybe you want to have a look at the "bin" command (<A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bin" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bin</A>) to group your events by day with a "span=1d" parameter.</P> Wed, 30 Sep 2020 06:00:18 GMT rvany 2020-09-30T06:00:18Z https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522037#M147186 <P>I'm trying to list out all dates between my time picker and have that as a column in my table. I do both things individually but just not together <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P><P>index="myindex"<BR />| rex "jobID (?&lt;jobid&gt;\d+)"<BR />| rex "dayID (?&lt;dayid&gt;\d+)"<BR />| eval daydt=strptime(dayid, "%Y%m%d")<BR />| eval daydt=strftime(daydt,"%Y-%m-%d")<BR />| transaction jobid dayid endswith="data consumed for jobID"<BR />|eval duration=tostring(duration,"duration")<BR />| eval status=if(closed_txn=="0","Complete","Incomplete")<BR />| appendpipe<BR />[ |gentimes start=-1|addinfo|eval date=strftime(mvrange(info_min_time,info_max_time,"1d"),"%F")|mvexpand date<BR />]<BR />| sort -date<BR />| table date closed_txn daydt _time duration</P><P>&nbsp;</P><P>Can someone tell me whats wrong here?</P> Tue, 29 Sep 2020 16:16:10 GMT https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522037#M147186 tb5821 2020-09-29T16:16:10Z https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522051#M147190 <P>What do you exactly mean with "all dates between my time picker"? What is the output of your SPL? What did you expect? Could you give some example data?</P> Tue, 29 Sep 2020 16:51:38 GMT https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522051#M147190 rvany 2020-09-29T16:51:38Z https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522066#M147197 <P>if I select last 30 days - I want one column that has a row for each day regardless of what my main search has</P><P>&nbsp;</P> Tue, 29 Sep 2020 17:27:58 GMT https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522066#M147197 tb5821 2020-09-29T17:27:58Z https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522068#M147198 What should be in that one column? Can you mock it up? Tue, 29 Sep 2020 17:59:24 GMT https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522068#M147198 richgalloway 2020-09-29T17:59:24Z https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522154#M147223 <P>Should this "day column" go on a row of its own? What if you have more than one data rows for a particular day?</P><P>Maybe you want to have a look at the "bin" command (<A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bin" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bin</A>) to group your events by day with a "span=1d" parameter.</P> Wed, 30 Sep 2020 06:00:18 GMT https://community.splunk.com/t5/Splunk-Search/Listing-out-dates-and-appending-to-search/m-p/522154#M147223 rvany 2020-09-30T06:00:18Z